CVE-2026-53909 describes a vulnerability in MyComplianceOffice MCO version 25.3.3.1 where the application does not properly validate the types of files uploaded to the server. The validation depends exclusively on client-side checks, which can be bypassed by an authorized user with low privileges. This allows such an attacker to upload files with arbitrary and potentially dangerous types, potentially leading to security risks. Attempts to contact the vendor for remediation information were unsuccessful, and no patch or official fix has been documented.

An authorized user with low privileges can upload files of arbitrary types to the server due to insufficient server-side validation. This could lead to risks such as uploading malicious files or bypassing intended restrictions on file types. However, there is no indication of exploitation in the wild or further impact details beyond the ability to upload arbitrary file types.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented and vendor contact attempts were unsuccessful, users should monitor vendor channels for updates. Until a fix is available, consider restricting file upload permissions and implementing additional server-side validation controls if possible.